CVE-2024-1896: 
WordPress vulnerability analysis and mitigation

The Photo Gallery – Responsive Photo Gallery plugin for WordPress contains a PHP Object Injection vulnerability (CVE-2024-1896) affecting all versions up to and including 1.4.1. The vulnerability exists in the deserialization of untrusted input from the 'awl_lg_settings_' attribute via shortcode (Wordfence).

The vulnerability allows authenticated attackers with contributor access and above to inject PHP Objects through the deserialization of untrusted input. While no POP (Property-Oriented Programming) chain is present in the vulnerable plugin itself, if a POP chain exists via an additional plugin or theme installed on the target system, it could enable further exploitation. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) (NVD).

If successfully exploited, this vulnerability could allow attackers to delete arbitrary files, retrieve sensitive data, or execute code on the target system when combined with a suitable POP chain from another installed plugin or theme (Wordfence).

The vulnerability requires authentication with at least contributor-level access to exploit. While no POP chain is present in the plugin itself, the presence of additional plugins or themes with suitable POP chains could make exploitation possible (NVD).